AidWP – Donation & Payment Forms (Stripe Powered) Security & Risk Analysis

The "wp-stripe-donation" v3.3.0 plugin exhibits a mixed security posture. While it has no currently unpatched vulnerabilities, its static analysis reveals significant concerns. A substantial attack surface exists with 6 unprotected AJAX handlers, presenting a prime target for unauthorized actions. The presence of 11 dangerous functions, including the potent `unserialize`, and a high percentage of SQL queries not using prepared statements (68%) indicate potential for code injection and data manipulation vulnerabilities.

Taint analysis further highlights a critical risk with one flow identified as having unsanitized paths, which could lead to severe security breaches if exploited. Although the plugin includes nonce and capability checks, their absence on a majority of AJAX entry points is a major weakness. The vulnerability history, despite having no recent critical or high-severity issues, shows a pattern of missing authorization and CSRF vulnerabilities, suggesting a recurring tendency for insecure handling of user input and actions.

In conclusion, while the plugin has a clean record for unpatched CVEs, the static analysis and taint results point to significant underlying security flaws. The high number of unprotected AJAX handlers, the use of dangerous functions, and the prevalence of raw SQL queries are critical areas that need immediate attention. The historical pattern of authorization and CSRF issues reinforces the need for more robust security measures to prevent future exploitation.